mrweasel

Hang in there, in a few years we'll be mining gold cleaning up the mess.

I work in an AI sceptical organization, it's not that we don't use AI agent or consult chat bots, but they are kept a good distance from production. Talking to other SREs in AI heavy and AI first companies I don't see that ending well. SREs struggled with operating applications from developers who cannot or will not understand how computers and the internet work. Now many of the junior developers are even worse and some of them are given the title of "DevOps" and they are using AI to create some of the most broken ass Terraform code and bastard Helm charts to run their broken code. Some SREs are spending more time fighting agents and agent written infrastructure code than they would have, had they been allowed to write it themselves.

If tokens becomes to expensive, we're left with a ton of broken code and infrastructure that can only be managed at an inflated cost. There will be good money to be made consulting and cleaning up the mess of AI boom.

Would that really help, if you install the extension it's running in the VSCodium instance on your machine... or is it running in the vscode-server?

Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?

That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.

You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.

This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.

How will they communicate and fix that. The affected version has been yanked from the marketplace: https://marketplace.visualstudio.com/items?itemName=anthropi... but that doesn't clean up infected machines.

Sure, but the pizzeria charges less than $4 for delivery and don't want a tip.

I completely understand the grocery deliveries, it's a trade off, time vs. money. Personally I think the delivery costs are to high, but I also live four minutes away from the supermarket on foot. For others it's one less thing to deal with and they can do the shopping in the evening when the kids are put to bed or have the groceries ready when they come home after a long day. For them the delivery fee is well worth the value the service provides.

It's the $10+ for getting McDonalds multiple times a week I struggle with. People are free to make that choice obviously, but I feel like the delivery services are praying on people who are already struggling, especially when they team up the Buy Now Pay Later companies.

From the article:

> they are not hesitant to use a coding assistant, they are hesitant to go all in and let the agents do all the execution.

They are embracing the use of coding agents, but they still want to be in control. That also matches what I see from my most talented colleagues. They outsource certain tasks to the AI and verify the output.

My somewhat unpopular opinion is that only very good developers are able to use AI coding tools somewhat safely. They could have written the code themselves, but it's faster to have the agent do and then verify. The rest of us couldn't write the code, at least not when we start on a project. When we finish, we have some of the skills and could rely more on the AI tools if we were to do it again.

I knew about Spain doing it to align with Germany, but I had no idea that France used to be UTC.

> So from an utility and democracy point of view the wellbeing of the majority

Or you know, you could just put countries in different timezones. Apparently that's easier than convincing people that the workday doesn't need to start at 8:00 (or 10:00 in the case of many in Southern Europe).

> Spain is already in the wrong time zone for standard time

That's probably even more of an issue for Spain, made even stranger by the fact that Portugal is in the "correct" timezone.

It apparently mattered enough that Russia reverted it's decision to stay on DST.

But I do live in the North and in the EU... I care a create deal about not being stress and depressed.

It is actually an issue and in some sense I think there is a case to be made for a timezone split between northern Europe and southern Europe. So e.g. putting Scandinavia in UTC +1 and Spain and Italy in UTC +2. Where we draw the line is tricky, because I doubt that nether France or Germany would want two timezones.

I don't know it this will be the case for Cuba, as it's somewhat differently placed on the map, but Russia tried DST only and had to switch to standard time and then stayed there.

Some people absolutely loves DST for some reason, but it creates stress and mental problems for people, especially in the north. The long mornings are somehow worse than the short evenings. Technically it shouldn't matter what the clock shows, but when society insists on things happening at a certain time, whether or not the sun is out becomes important.

For the Russian case see: https://www.bbc.com/news/blogs-news-from-elsewhere-28423647

Most I've seen are just used to RDP into a Windows box anyway, so probably not. That does make it a little strange that no one seems to design a nice looking terminal PC.

Years ago I worked for a company that had an application, written in Delphi, running as a DLL in IIS (on Windows obviously). To more easily deliver certain features fast, open source PHP code was run in parallel, e.g. some customer wants a visitor counter, so that just got bolted on using PHP.

There are some absolutely insane systems out there.

> How often are people paying at least $600 annually for something AI can help them do instead

I'm going to need an example on this one, and examples that can't be covered equally well by a YouTube video or an 20 year old forum post. It also has to be legal, as in not violating codes for electrics or plumping, I can violate those on my own for free.

It's the same price as a MacBook Neo

> RAM/Chip prices are way, way up

So that cloud providers can have servers and GPUs sitting unpowered in warehouses and datacenters.

So what happens if AI becomes something that you need to actually pay real money for? Then only Apple, Google and Microsoft can affort to do network exposed software. Smaller companies and solo developers are just f-ed if the price of running LLMs goes up as investor money dries up.

If this continues I'll argue that you have to be absolutely insane to allow network connected electronics into your home in the future. This is Apple, known for locking down their device to the extreme, and yes some people would love to use this for jailbreaking their phones, other organisations want to root your phone for .... other purposes.

Insecure webpages, broken certificates and an insecure PDF library... You shouldn't have anything more connected than an FM radio at this point. Security is no longer something a private individual can deal with.

We ran a number of tests, including sending a percentage of real traffic to endpoints running AWS-LC and Wolfssl. Technically yes, OpenSSL 3.X is slow, measurably so, but not enough that we wanted to deal with it. That's for our use case, I can easily imagine there being others, where maybe you have different hardware or way more traffic, where it would be worth while. For basic TLS termination in haproxy, it wasn't really worth it to us.

True, we still have Netflix, despite almost never using it, because "we might want to watch something". Frankly the main reason is because my in-laws also use the account and enjoys it.

The lesson I've learned, the same as I learned from Facebook, is "Never sign up to another service ever again". It's much easier to just never sign up than it is to convince the entire family that you should cancel something.

I don't know, if you want a cable tv package, where I live, that's even remotely good you're looking at $1250 a year. We have four streaming services and that's still cheaper and I then also have streaming music include.

Make you wonder what they've been testing this on. Even NetBSD doesn't have a recent release for Itanium. Crazy that you can run NetBSD 11.0 on HPPA, but not Itanium, given that HPPA is in some sense the pre-cursor to Itanium.

One argument could be that they want to provide an AI solution, but maintain some level of control. Copilot can be bundled in with existing licenses, so it's a easier purchase in some sense.

Across the bridge, in Denmark, we've already seen a number of cases where government employees have use various AIs to help them do their job (and in many case used an AI to fail at doing their job). The result has been information about citizens just being entered into whatever AI the employee fancied, without worry about leaking private and sensitive information. I'm not entirely convinced that the public employees strictly speaking needs an AI, but if they are going to use one regardless, it makes sense that it's one that has been approved, whatever that might mean.

You're reading it the wrong way, I think. Their certificate business is so small, 1% of revenue, that it's not worth trying to rescue it after the amount of attention it has been getting. It simply wouldn't be profitable.

The more telling thing to me is that they explain that THEIR core business is unaffected, but they don't explain that they fucked up so badly that everyone else had to step in and actively update their trust chains to work around eMudhra to avoid putting every single internet user at risk.

Quite frankly I doubt they understand how massively they've screwed up, or they are trying to hide it to avoid absorbing any blame for the fallout.

If they don't do any verification, and I'm not sure how they would in countries like the US, then any fraud case or attempt to claw in money from random people should be thrown out of court by any reasonable judge.

Requiring only public information and a SSN that has probably leaked hundreds of times and can be accessed by any number of random people in public and private administration just shouldn't count as even an attempt to verify identity.

Okay, that might have been worded wrong. I don't the device selection as being particularly supportive of more than a few limited use cases. If you're at home it would make more sense to support your Xbox streaming to your VR headset or Smart TV, you shouldn't have to go via the cloud.

If you're out, on vacation or something, then sure streaming to your phone or tablet makes sense, but you're not going to sign in to a random Smart TV or PC with your Xbox account (at least Microsoft shouldn't encourage that behaviour). That just seems like such a limited use case to me.

That just seems like such a strange offering. The number of supported devices is fairly low[0], and you already need to have purchased the game (well hold a license to the game). Some of the supported devices are Xboxes and some are Smart TVs, in that setup it would make more sense to have the TV use your own Xbox (assuming that they are on the same LAN).

The price seems a little high, as I expect them to be before tax and currency conversion, but mostly I struggle to see who this is for.

https://support.xbox.com/en-US/help/games-apps/cloud-gaming/...